Serverless Brain Dump: Use Lambda with RDS Aurora Serverless

package main

import (
	"context"
	"errors"
	"log"
	"time"

	"github.com/aws/aws-sdk-go-v2/aws"
	"github.com/aws/aws-sdk-go-v2/config"
	ec2 "github.com/aws/aws-sdk-go-v2/service/ec2"
	ec2types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
	iam "github.com/aws/aws-sdk-go-v2/service/iam"
	lambda "github.com/aws/aws-sdk-go-v2/service/lambda"
	lambdaTypes "github.com/aws/aws-sdk-go-v2/service/lambda/types"
)

// This series of operations is necessary for a Lambda to connect to Aurora Serverless
func AttachLambdaToVpc(lambdaArn, vpcId, roleName string) error {
	cfg, _ := config.LoadDefaultConfig(context.TODO(), config.WithRegion("us-east-1"))

	ec2service := ec2.NewFromConfig(cfg)

	// get subnets for the VPC
	log.Println("Getting subnets for VPC", vpcId)
	subnets, _ := ec2service.DescribeSubnets(context.TODO(), &ec2.DescribeSubnetsInput{
		Filters: []ec2types.Filter{
			ec2types.Filter{
				Name:   aws.String("vpc-id"),
				Values: []string{vpcId},
			},
		},
	})

	var subnetIds []string
	for _, subnet := range subnets.Subnets {
		subnetIds = append(subnetIds, *subnet.SubnetId)
	}
	log.Println("Subnets:", subnetIds)

	// get a single security group for the VPC
	log.Println("Getting security group for VPC", vpcId)
	sg, _ := ec2service.DescribeSecurityGroups(context.TODO(), &ec2.DescribeSecurityGroupsInput{
		Filters: []ec2types.Filter{
			ec2types.Filter{
				Name:   aws.String("vpc-id"),
				Values: []string{vpcId},
			},
		},
	})

	securityGroupId := *sg.SecurityGroups[0].GroupId
	log.Println("Security Group:", securityGroupId)

	// update FunctionConfiguration
	log.Println("Updating FunctionConfiguration for", lambdaArn)

	for i := 1; i < 5; i++ {
		shouldRetry := tryUpdateLambdaConfig(lambdaArn, vpcId, roleName, securityGroupId, subnetIds)
		if shouldRetry {
			log.Println("Waiting 5 seconds before retrying...")
			time.Sleep(5 * time.Second)
		} else {
			break
		}
	}
	return nil
}

func tryUpdateLambdaConfig(lambdaArn string, vpcId string, roleName string, securityGroupId string, subnetIds []string) bool {
	cfg, _ := config.LoadDefaultConfig(context.TODO(), config.WithRegion("us-east-1"))
	lambdaService := lambda.NewFromConfig(cfg)
	iamService := iam.NewFromConfig(cfg)

	var shouldRetry bool

	if updateOutput, err := lambdaService.UpdateFunctionConfiguration(context.TODO(), &lambda.UpdateFunctionConfigurationInput{
		FunctionName: aws.String(lambdaArn),
		VpcConfig: &lambdaTypes.VpcConfig{
			SecurityGroupIds: []string{securityGroupId},
			SubnetIds:        subnetIds,
		},
	}); err != nil {
		var ipe *lambdaTypes.InvalidParameterValueException
		if errors.As(err, &ipe) {
			// handle the following error:
			// InvalidParameterValueException: The provided execution role does not have permissions to call CreateNetworkInterface on EC2
			log.Println("UpdateFunctionConfiguration error:", ipe)
			log.Println("  Attaching policy:", "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole")
			log.Println("  ...to role:", roleName)

			if _, err := iamService.AttachRolePolicy(context.TODO(), &iam.AttachRolePolicyInput{
				PolicyArn: aws.String("arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"),
				// ⚠️ This must be role name string; You cannot use ARN for some reason...
				RoleName: aws.String(roleName),
			}); err != nil {
				log.Println("error:", err)
				log.Fatalln("Failed to attach policy to role")
			} else {
				log.Println("Successfully attached IAM policy to role. Please run this again.")
			}

			// signal to the consumer that we should retry
			shouldRetry = true
			return shouldRetry
		} else {
			log.Fatalln("UpdateFunctionConfiguration unexpected error:", err)
		}

	} else {
		log.Println("Successfully updated FunctionConfiguration:")
		log.Println(*updateOutput.FunctionName)
		log.Println(*updateOutput.FunctionArn)
	}

	return shouldRetry
}

package main

// example usage
func main() {
  AttachLambdaToVpc(
		"arn:aws:lambda:us-east-1:XXXXXXXXXXXX:function:wp-nodejs-express", // lambdaArn
		"vpc-XXXXXXXX",             // vpcId
		"lambda-wp-nodejs-express", // roleName
	)
}